Unable to excute upgrade to VCF 9.0 for the workload domain as failing the precheck assessment

Products

• VCF Operations

Issue/Introduction

• When run precheck in operation lifecycle to upgrade a workload domain the following error appear : 

  vCenter root account is locked or has expired

• When they try to remediate password to the vcenter via SDDC manager they get the error: 

  Failed donwload /tmp/vmwre-root_####-###########/password-managervmware12.tmp in VM with FQDN <VCENTER_FQDN>.error: org.bouncycastle.tls.TlsFatalAlert: certificate unknown(46)

Environment

• VMware Cloud Foundation (VCF) 9.0.2

Cause

Symptoms are typically caused by one or more of the following:

• DNS Misconfiguration: Incorrect PTR records causing hostname resolution to non-ESXi networks.
• vCenter Instance Mismatch: The vCenter Server is registered to a different VCF management instance than the one currently attempting to manage it.
• Untrusted NSX Certificates: Self-signed or untrusted certificates in the NSX Manager preventing the TLS handshake during credential validation.

Resolution

To help resolving the issue to execute the following steps:

1. Verify DNS Configuration: Ensure all ESXi host and vCenter FQDNs resolve to the correct management network IP address. Remove any incorrect PTR records in your DNS environment.
2. Validate vCenter Instance Mapping: Confirm that the vCenter Server is correctly registered to the local VCF instance appliance. Use the SDDC Manager API to inspect the vcenter-registration status.
3. Update NSX Certificates: If you encounter certificate_unknown(46) errors during remediation, export the current NSX Manager certificate and import it into the SDDC Manager trust store:
   • Retrieve the certificate via browser or openssl s_client.
   • Import using keytool or the trusted_certificates.store import script provided in the article Error: certificate_unknown(46) - ESXi host root and vcf-svc accounts disconnected in VCF workload domain
4. Perform Lifecycle Pre-checks: Trigger the VCF Operations pre-checks again to verify the environment is clean before retrying the Workload Domain operation.